T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:201- Finding
API Credentials Embedded in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
MindStudio HTTP Request Block Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a transparent MindStudio HTTP request configuration guide, but users should be careful about what data and credentials they send to outside services.
Install only if you need MindStudio HTTP Request block help. Before using generated configurations, verify the destination service and hostname, send only the minimum required fields, avoid sending secrets or sensitive personal data unless authorized, treat webhook URLs as credentials, prefer auth headers over query-string tokens, and require an explicit review before PATCH, PUT, or DELETE workflows affect real records.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
examples.md:116- Finding
URL-Authenticated Webhooks Used to Transmit Sensitive Workflow Data Without Adequate Safeguards
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
Because the skill is expressly optimized to help users send workflow output to external endpoints, it can be used to facilitate exfiltration when the output contains sensitive information. The danger is amplified by the broad invocation rule and the lack of explicit prohibitions on transmitting secrets, personal data, internal prompts, or confidential workflow contents.
- Content
md --- name: mindstudio-http-request-block-skill description: Configure and use the MindStudio HTTP Request block to send data to external APIs, webhooks, and web services. Use this skill whenever a user mentions HTTP requests, webhooks, calling an API, connecting to Make, Zapier, HubSpot, Airtable, Finnhub, or any external service from MindStudio, wants to fetch or POST data mid-workflow, or asks how to send workflow output somewhere. Always use this skill — do not attempt to configure an HTTP Request block from memory. Even if the request seems simple ("how do I POST to a webhook"), use this skill. --- # MindStudio HTTP Request Block Skill
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
json { "name": "mindstudio-http-request-block", "version": "1.0.0", "description": "Configure and use the MindStudio HTTP Request block to send data to external APIs, webhooks, and web services. Use this skill whenever a user mentions HTTP requests, webhooks, calling an API, connecting to Make, Zapier, HubSpot, Airtable, Finnhub, or any external service from MindStudio, wants to fetch or POST data mid-workflow, or asks how to send workflow output somewhere. Always use this skill — do not attempt to configure an HTTP Request block from memory.", "author": "Sol", "platform": "MindStudio", "skill_file": "SKILL.md",
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest explicitly supports sending workflow output to external services and includes PATCH, PUT, and DELETE scenarios, but provides no warning about privacy, credential handling, irreversible changes, or user confirmation for destructive actions. In this context, the omission is dangerous because the skill is centered on transmitting potentially sensitive data and performing state-changing operations against third-party systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly encourages sending workflow output to external services but does not warn users to evaluate whether that output may contain sensitive, personal, regulated, or proprietary data. In a skill centered on HTTP requests and webhooks, this omission can lead to accidental exfiltration of secrets or user data to third-party systems, especially by less experienced builders who may treat all workflow output as safe to transmit.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill is explicitly designed to help send workflow output and other variables to external APIs, webhooks, and services. In context, external transmission is the primary function, and without strong authorization and privacy checks this materially increases the risk of sensitive data leaving the trusted environment.
- Content
md --- name: mindstudio-http-request-block-skill description: Configure and use the MindStudio HTTP Request block to send data to external APIs, webhooks, and web services. Use this skill whenever a user mentions HTTP requests, webhooks, calling an API, connecting to Make, Zapier, HubSpot, Airtable, Finnhub, or any external service from MindStudio, wants to fetch or POST data mid-workflow, or asks how to send workflow output somewhere. Always use this skill — do not attempt to configure an HTTP Request block from memory. Even if the request seems simple ("how do I POST to a webhook"), use this skill. --- # MindStudio HTTP Request Block Skill
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's invocation guidance is extremely broad ('always use this skill' for nearly any API/webhook mention), which can cause the assistant to route many requests into a data-transmission workflow without first evaluating whether external transfer is appropriate. In a security context, broad auto-invocation increases the chance of over-collecting details and facilitating unintended outbound data flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill provides detailed instructions for sending workflow variables, AI outputs, emails, CRM fields, and other data to external APIs and webhooks, but it does not require the operator to assess whether the data is sensitive, authorized for sharing, or subject to privacy obligations. This omission can directly enable exfiltration of personal, confidential, or system-derived data to third parties.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Before writing any configuration, determine what the user is trying to do. Match their intent to one of the five scenarios below, then ask only the questions listed for that scenario. Do not ask questions from other scenarios. Do not guess at variable names — use exactly what the user provides. If the user's intent is already clear from context (e.g. they said "POST my AI output to a Make webhook"), skip straight to the questions for that scenario without asking them to confirm the scenario type. ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **Trigger:** User wants to update an existing record in an external system — CRM contact, database row, project record, etc. **Ask the user:** 1. What is the base endpoint URL? (e.g. `https://api.example.com/contacts`) 2. What is the record ID variable name in your workflow? (e.g. `{{contact_id}}`, `{{record_id}}`) — this gets appended to the URL 3. Are you updating specific fields only (PATCH) or replacing the entire record (PUT)? 4. Which fields are being updated? List the exact variable names and what each field represents.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **Trigger:** User wants to update an existing record in an external system — CRM contact, database row, project record, etc. **Ask the user:** 1. What is the base endpoint URL? (e.g. `https://api.example.com/contacts`) 2. What is the record ID variable name in your workflow? (e.g. `{{contact_id}}`, `{{record_id}}`) — this gets appended to the URL 3. Are you updating specific fields only (PATCH) or replacing the entire record (PUT)? 4. Which fields are being updated? List the exact variable names and what each field represents.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **Trigger:** User wants to update an existing record in an external system — CRM contact, database row, project record, etc. **Ask the user:** 1. What is the base endpoint URL? (e.g. `https://api.example.com/contacts`) 2. What is the record ID variable name in your workflow? (e.g. `{{contact_id}}`, `{{record_id}}`) — this gets appended to the URL 3. Are you updating specific fields only (PATCH) or replacing the entire record (PUT)? 4. Which fields are being updated? List the exact variable names and what each field represents.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This example explicitly sends customer identifiers and AI-generated content to a third-party Make webhook, but it does not warn that workflow data leaves the platform or advise users to validate consent, data classification, or downstream retention. In a skill whose purpose is configuring outbound HTTP requests, omission of privacy/data-sharing cautions can lead users to transmit sensitive personal or proprietary content to external automation services without realizing the exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HubSpot contact creation example transmits PII such as name, email, company, and phone to an external CRM but does not disclose that this is external sharing or advise on consent and compliance. Because this skill is instructional and likely reused by non-expert users, the missing warning increases the chance of inappropriate transfer of regulated or customer data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Block Configuration:
text URL : https://api.hubspot.com/crm/v3/objects/contacts Method : POST Content-Type : application/json Headers :
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Block Configuration:
text URL : https://api.hubspot.com/crm/v3/objects/contacts Method : POST Content-Type : application/json Headers :
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Block Configuration:
text URL : https://api.hubspot.com/crm/v3/objects/contacts Method : POST Content-Type : application/json Headers :
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Block Configuration:
text URL : https://api.airtable.com/v0/{{airtableBaseId}}/Projects/{{record_id}} Method : PUT Content-Type : application/json Headers :
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Block Configuration:
text URL : https://api.projecttool.example.com/projects/{{project_id}} Method : DELETE Content-Type : none Headers :
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This example posts an email address, document title, and AI-generated document content to Zapier, but it omits any warning that content is being forwarded to a third-party automation provider and possibly onward to additional connected apps. That omission is risky because users may treat the example as a generic integration recipe and unintentionally disclose sensitive document contents beyond the original workflow boundary.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json { "name": "mindstudio-http-request-block", "version": "1.0.0", "description": "Configure and use the MindStudio HTTP Request block to send data to external APIs, webhooks, and web services. Use this skill whenever a user mentions HTTP requests, webhooks, calling an API, connecting to Make, Zapier, HubSpot, Airtable, Finnhub, or any external service from MindStudio, wants to fetch or POST data mid-workflow, or asks how to send workflow output somewhere. Always use this skill — do not attempt to configure an HTTP Request block from memory.", "author": "Sol", "platform": "MindStudio", "skill_file": "SKILL.md",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to 'Always use this skill' whenever related topics appear, creating unconditional activation with unclear boundaries. That design bypasses normal intent discrimination and can route benign questions into a capability that supports outbound requests and destructive methods, increasing the risk of unsafe guidance or unintended external actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to capture many ordinary requests about APIs, integrations, or sending data, which can cause the skill to activate in situations where the user did not clearly intend outbound network activity. In a skill that enables external HTTP requests, overbroad routing increases the chance of accidental data disclosure or unsafe destructive operations being suggested without sufficient contextual checks.
- Content
Static analysis
No suspicious patterns detected.